claims.patch

diff --git a/src/idpyoidc/client/claims/__init__.py b/src/idpyoidc/client/claims/__init__.py
index 1427005..a13f25d 100644
--- a/src/idpyoidc/client/claims/__init__.py
+++ b/src/idpyoidc/client/claims/__init__.py
@@ -13,6 +13,8 @@ def get_client_authn_methods():


 class Claims(claims.Claims):
+    _supports = {}
+
     def get_base_url(self, configuration: dict, entity_id: Optional[str] = ""):
         _base = configuration.get("base_url")
         if not _base:
@@ -56,7 +58,7 @@ class Claims(claims.Claims):
             if (
                 len(_own_keys) == 1
                 and isinstance(_own_keys[0], SYMKey)
-                and self.prefer["client_secret"]
+                and self.prefer.get("client_secret", None)
             ):
                 pass
             else:
diff --git a/src/idpyoidc/client/claims/oauth2.py b/src/idpyoidc/client/claims/oauth2.py
index 9d093d4..f4cf8d9 100644
--- a/src/idpyoidc/client/claims/oauth2.py
+++ b/src/idpyoidc/client/claims/oauth2.py
@@ -1,21 +1,38 @@
 from typing import Optional

 from idpyoidc.client import claims
-from idpyoidc.client.claims.transform import create_registration_request
+from idpyoidc.transform import create_registration_request
+
+REGISTER2PREFERRED = {
+    "scope": "scopes_supported",
+    "token_endpoint_auth_signing_alg": "token_endpoint_auth_signing_alg_values_supported",
+    "response_types": "response_types_supported",
+    # "response_modes": "response_modes_supported",
+    "grant_types": "grant_types_supported",
+    "token_endpoint_auth_method": "token_endpoint_auth_methods_supported",
+    "token_auth_signing_algs": "token_auth_signing_algs_supported",
+    # 'ui_locales': 'ui_locales_supported',
+}


 class Claims(claims.Claims):
+    register2preferred = REGISTER2PREFERRED
+
     _supports = {
         "redirect_uris": None,
-        "grant_types_supported": ["authorization_code", "implicit", "refresh_token"],
+        # "scopes_supported": [],
         "response_types_supported": ["code"],
+        # "response_modes_supported": ["query", "fragment"],
+        "grant_types_supported": ["authorization_code", "implicit", "refresh_token"],
+        "token_endpoint_auth_methods_supported": ["none", "client_secret_post", "client_secret_basic"],
+        # "token_auth_signing_algs_supported": metadata.get_signing_algs(),
         "client_id": None,
-        "client_secret": None,
         "client_name": None,
+        "client_secret": None,
         "client_uri": None,
         "logo_uri": None,
+        "scope": None,
         "contacts": None,
-        "scopes_supported": [],
         "tos_uri": None,
         "policy_uri": None,
         "jwks_uri": None,


diff --git a/src/idpyoidc/client/claims/oauth2resource.py b/src/idpyoidc/client/claims/oauth2resource.py
index 537e139..2bec3c8 100644
--- a/src/idpyoidc/client/claims/oauth2resource.py
+++ b/src/idpyoidc/client/claims/oauth2resource.py
@@ -2,7 +2,7 @@ from typing import Optional

 from idpyoidc.client import claims
 from idpyoidc.message.oauth2 import OAuthProtectedResourceRequest
-from idpyoidc.client.claims.transform import array_or_singleton
+from idpyoidc.transform import array_or_singleton

 class Claims(claims.Claims):
     _supports = {



diff --git a/src/idpyoidc/client/claims/oidc.py b/src/idpyoidc/client/claims/oidc.py
index 0529f16..d8ae08b 100644
--- a/src/idpyoidc/client/claims/oidc.py
+++ b/src/idpyoidc/client/claims/oidc.py
@@ -2,9 +2,9 @@ import logging
 import os
 from typing import Optional

-from idpyoidc import metadata
+from idpyoidc import alg_info
 from idpyoidc.client import claims as client_claims
-from idpyoidc.client.claims.transform import create_registration_request
+from idpyoidc.transform import create_registration_request
 from idpyoidc.message.oidc import APPLICATION_TYPE_WEB
 from idpyoidc.message.oidc import RegistrationRequest
 from idpyoidc.message.oidc import RegistrationResponse
@@ -71,14 +71,15 @@ class Claims(client_claims.Claims):
         "client_name": None,
         "client_secret": None,
         "client_uri": None,
+        "code_challenge_methods_supported": None,
         "contacts": None,
         "default_max_age": 86400,
         "encrypt_id_token_supported": None,
         # "grant_types_supported": ["authorization_code", "refresh_token"],
         "logo_uri": None,
-        "id_token_signing_alg_values_supported": metadata.get_signing_algs(),
-        "id_token_encryption_alg_values_supported": metadata.get_encryption_algs(),
-        "id_token_encryption_enc_values_supported": metadata.get_encryption_encs(),
+        "id_token_signing_alg_values_supported": alg_info.get_signing_algs(),
+        "id_token_encryption_alg_values_supported": alg_info.get_encryption_algs(),
+        "id_token_encryption_enc_values_supported": alg_info.get_encryption_encs(),
         "initiate_login_uri": None,
         "jwks": None,
         "jwks_uri": None,
@@ -95,13 +96,13 @@ class Claims(client_claims.Claims):
         client_claims.Claims.__init__(self, prefer=prefer, callback_path=callback_path)

     def verify_rules(self, supports):
-        if self.get_preference("request_parameter_supported") and self.get_preference(
-            "request_uri_parameter_supported"
-        ):
-            raise ValueError(
-                "You have to chose one of 'request_parameter_supported' and "
-                "'request_uri_parameter_supported'. You can't have both."
-            )
+        # if self.get_preference("request_parameter_supported") and self.get_preference(
+        #     "request_uri_parameter_supported"
+        # ):
+        #     raise ValueError(
+        #         "You have to chose one of 'request_parameter_supported' and "
+        #         "'request_uri_parameter_supported'. You can't have both."
+        #     )

         if self.get_preference("request_parameter_supported") or self.get_preference(
             "request_uri_parameter_supported"

diff --git a/src/idpyoidc/server/__init__.py b/src/idpyoidc/server/__init__.py
index 78c2370..9657257 100644
--- a/src/idpyoidc/server/__init__.py
+++ b/src/idpyoidc/server/__init__.py
@@ -6,6 +6,7 @@ from typing import Optional
 from typing import Union

 from cryptojwt import KeyJar
+from cryptojwt.utils import importer

 from idpyoidc.client.defaults import DEFAULT_KEY_DEFS
 from idpyoidc.node import Unit
@@ -52,6 +53,9 @@ class Server(Unit):
             if _conf:
                 self.entity_id = _conf.get("entity_id", "")
         self.issuer = conf.get("issuer", self.entity_id)
+        if not self.entity_id and self.issuer:
+            self.entity_id = self.issuer
+
         self.persistence = None

         if upstream_get is None:
@@ -95,6 +99,19 @@ class Server(Unit):

         _token_endp = self.endpoint.get("token")

+        if isinstance(conf, dict):
+            metadata_schema = conf.get("metadata_schema", None)
+        else:
+            metadata_schema = conf.conf.get("metadata_schema", None)
+        if metadata_schema:
+            metadata_schema = importer(metadata_schema)
+        self.context.provider_info = self.context.claims.get_server_metadata(
+            endpoints=self.endpoint.values(),
+            metadata_schema=metadata_schema,
+        )
+        self.context.provider_info["issuer"] = self.issuer
+        self.context.metadata = self.context.provider_info
+
         self.context.map_supported_to_preferred()
         if _token_endp:
             _token_endp.allow_refresh = allow_refresh_token(self.context)
diff --git a/src/idpyoidc/server/claims/oauth2.py b/src/idpyoidc/server/claims/oauth2.py
index 86e969d..243e09b 100644
--- a/src/idpyoidc/server/claims/oauth2.py
+++ b/src/idpyoidc/server/claims/oauth2.py
@@ -1,5 +1,6 @@
 from typing import Optional

+from idpyoidc.message import Message
 from idpyoidc.message.oauth2 import ASConfigurationResponse
 from idpyoidc.server import claims

@@ -38,9 +39,12 @@ class Claims(claims.Claims):
     def __init__(self, prefer: Optional[dict] = None, callback_path: Optional[dict] = None):
         claims.Claims.__init__(self, prefer=prefer, callback_path=callback_path)

-    def provider_info(self, supports):
+    def metadata(self, supports, schema: Optional[Message] = None):
         _info = {}
-        for key in ASConfigurationResponse.c_param.keys():
+        if schema is None:
+            schema = ASConfigurationResponse
+
+        for key in schema.c_param.keys():
             _val = self.get_preference(key, supports.get(key, None))
             if _val and _val != []:
                 _info[key] = _val
diff --git a/src/idpyoidc/server/claims/oidc.py b/src/idpyoidc/server/claims/oidc.py
index 2c258ba..0646410 100644
--- a/src/idpyoidc/server/claims/oidc.py
+++ b/src/idpyoidc/server/claims/oidc.py
@@ -1,6 +1,7 @@
 from typing import Optional

-from idpyoidc import metadata
+from idpyoidc import alg_info
+from idpyoidc.message import Message
 from idpyoidc.message.oidc import ProviderConfigurationResponse
 from idpyoidc.message.oidc import RegistrationRequest
 from idpyoidc.message.oidc import RegistrationResponse
@@ -48,9 +49,9 @@ class Claims(server_claims.Claims):
         "display_values_supported": None,
         "encrypt_id_token_supported": None,
         # "grant_types_supported": ["authorization_code", "implicit", "refresh_token"],
-        "id_token_signing_alg_values_supported": metadata.get_signing_algs(),
-        "id_token_encryption_alg_values_supported": metadata.get_encryption_algs(),
-        "id_token_encryption_enc_values_supported": metadata.get_encryption_encs(),
+        "id_token_signing_alg_values_supported": alg_info.get_signing_algs(),
+        "id_token_encryption_alg_values_supported": alg_info.get_encryption_algs(),
+        "id_token_encryption_enc_values_supported": alg_info.get_encryption_encs(),
         "initiate_login_uri": None,
         "jwks": None,
         "jwks_uri": None,
@@ -71,13 +72,13 @@ class Claims(server_claims.Claims):
         server_claims.Claims.__init__(self, prefer=prefer, callback_path=callback_path)

     def verify_rules(self, supports):
-        if self.get_preference("request_parameter_supported") and self.get_preference(
-                "request_uri_parameter_supported"
-        ):
-            raise ValueError(
-                "You have to chose one of 'request_parameter_supported' and "
-                "'request_uri_parameter_supported'. You can't have both."
-            )
+        # if self.get_preference("request_parameter_supported") and self.get_preference(
+        #         "request_uri_parameter_supported"
+        # ):
+        #     raise ValueError(
+        #         "You have to chose one of 'request_parameter_supported' and "
+        #         "'request_uri_parameter_supported'. You can't have both."
+        #     )

         if not self.get_preference("encrypt_userinfo_supported"):
             self.set_preference("userinfo_encryption_alg_values_supported", [])
@@ -91,7 +92,7 @@ class Claims(server_claims.Claims):
             self.set_preference("id_token_encryption_alg_values_supported", [])
             self.set_preference("id_token_encryption_enc_values_supported", [])

-    def provider_info(self, supports):
+    def provider_info(self, supports, schema: Optional[Message] = None):
         _info = {}
         for key in ProviderConfigurationResponse.c_param.keys():
             _val = self.get_preference(key, supports.get(key, None))


diff --git a/src/idpyoidc/server/configure.py b/src/idpyoidc/server/configure.py
index 3f304e7..bb4b507 100755
--- a/src/idpyoidc/server/configure.py
+++ b/src/idpyoidc/server/configure.py
@@ -83,7 +83,7 @@ _C = {
                 "client_authn_method": None,
                 "claims_parameter_supported": True,
                 "request_parameter_supported": True,
-                "request_uri_parameter_supported": True,
+                "request_uri_parameter_supported": None,
                 "response_types_supported": ["code"],
                 "response_modes_supported": ["query", "fragment", "form_post"],
             },
@@ -152,7 +152,7 @@ OP_DEFAULT_CONFIG.update(
                     "client_authn_method": None,
                     "claims_parameter_supported": True,
                     "request_parameter_supported": True,
-                    "request_uri_parameter_supported": True,
+                    "request_uri_parameter_supported": None,
                     "response_types_supported": [
                         "code",
                         # "token",
@@ -480,7 +480,7 @@ DEFAULT_EXTENDED_CONF = {
                 "client_authn_method": None,
                 "claims_parameter_supported": True,
                 "request_parameter_supported": True,
-                "request_uri_parameter_supported": True,
+                "request_uri_parameter_supported": None,
                 "response_types_supported": [
                     "code",
                     # "token",
diff --git a/src/idpyoidc/server/endpoint.py b/src/idpyoidc/server/endpoint.py
index 07c0080..56074ad 100755
--- a/src/idpyoidc/server/endpoint.py
+++ b/src/idpyoidc/server/endpoint.py
@@ -181,11 +181,11 @@ class Endpoint(Node):
         return None

     def parse_request(
-        self,
-        request: Union[Message, dict, str],
-        http_info: Optional[dict] = None,
-        verify_args: Optional[dict] = None,
-        **kwargs
+            self,
+            request: Union[Message, dict, str],
+            http_info: Optional[dict] = None,
+            verify_args: Optional[dict] = None,
+            **kwargs
     ):
         """

@@ -196,7 +196,9 @@ class Endpoint(Node):
         :return:
         """
         LOGGER.debug("- {} -".format(self.endpoint_name))
-        LOGGER.info("Request: %s" % sanitize(request))
+        LOGGER.info(f"Request: {sanitize(request)}")
+        if http_info:
+            LOGGER.info(f"HTTP info: {http_info}")

         _context = self.upstream_get("context")
         _keyjar = self.upstream_get("attribute", "keyjar")
@@ -240,8 +242,6 @@ class Endpoint(Node):
         else:
             _client_id = req.get("client_id", None)

-        LOGGER.debug(f"parse_request:auth_info:{auth_info}")
-
         # verify that the request message is correct, may have to do it twice
         err_response = self.verify_request(
             request=req, keyjar=_keyjar, client_id=_client_id, verify_args=verify_args
@@ -274,17 +274,18 @@ class Endpoint(Node):

         authn_info = verify_client(request=request, http_info=http_info, **kwargs)

-        LOGGER.debug("authn_info: %s", authn_info)
+        LOGGER.debug(f"authn_info: {authn_info}")
         if authn_info == {}:
             if self.client_authn_method and len(self.client_authn_method):
-                LOGGER.debug("client_authn_method: %s", self.client_authn_method)
+                LOGGER.debug(f"client_authn_method: {self.client_authn_method}")
                 raise UnAuthorizedClient("Authorization failed")
         elif "client_id" not in authn_info and authn_info.get("method") != "none":
+            LOGGER.debug(f"No client ID")
             raise UnAuthorizedClient("Authorization failed")
         return authn_info

     def do_post_parse_request(
-        self, request: Message, client_id: Optional[str] = "", **kwargs
+            self, request: Message, client_id: Optional[str] = "", **kwargs
     ) -> Message:
         _context = self.upstream_get("context")
         for meth in self.post_parse_request:
@@ -294,7 +295,7 @@ class Endpoint(Node):
         return request

     def do_pre_construct(
-        self, response_args: dict, request: Optional[Union[Message, dict]] = None, **kwargs
+            self, response_args: dict, request: Optional[Union[Message, dict]] = None, **kwargs
     ) -> dict:
         _context = self.upstream_get("context")
         for meth in self.pre_construct:
@@ -303,10 +304,10 @@ class Endpoint(Node):
         return response_args

     def do_post_construct(
-        self,
-        response_args: Union[Message, dict],
-        request: Optional[Union[Message, dict]] = None,
-        **kwargs
+            self,
+            response_args: Union[Message, dict],
+            request: Optional[Union[Message, dict]] = None,
+            **kwargs
     ) -> dict:
         _context = self.upstream_get("context")
         for meth in self.post_construct:
@@ -315,10 +316,10 @@ class Endpoint(Node):
         return response_args

     def process_request(
-        self,
-        request: Optional[Union[Message, dict]] = None,
-        http_info: Optional[dict] = None,
-        **kwargs
+            self,
+            request: Optional[Union[Message, dict]] = None,
+            http_info: Optional[dict] = None,
+            **kwargs
     ) -> Union[Message, dict]:
         """

@@ -329,10 +330,10 @@ class Endpoint(Node):
         return {}

     def construct(
-        self,
-        response_args: Optional[dict] = None,
-        request: Optional[Union[Message, dict]] = None,
-        **kwargs
+            self,
+            response_args: Optional[dict] = None,
+            request: Optional[Union[Message, dict]] = None,
+            **kwargs
     ):
         """
         Construct the response
@@ -350,19 +351,34 @@ class Endpoint(Node):
         return self.do_post_construct(response, request, **kwargs)

     def response_info(
-        self,
-        response_args: Optional[dict] = None,
-        request: Optional[Union[Message, dict]] = None,
-        **kwargs
+            self,
+            response_args: Optional[dict] = None,
+            request: Optional[Union[Message, dict]] = None,
+            **kwargs
     ) -> dict:
         return self.construct(response_args, request, **kwargs)

+    def _get_content_type(self, **kwargs):
+        content_type = kwargs.get("content_type", None)
+        if content_type is None:
+            if self.response_content_type:
+                content_type = self.response_content_type
+            elif self.response_format == "json":
+                content_type = "application/json"
+            elif self.response_format in ["jws", "jwe", "jose"]:
+                content_type = "application/jose"
+            elif self.response_format == "text":
+                content_type = "text/plain"
+            else:
+                content_type = "application/x-www-form-urlencoded"
+        return content_type
+
     def do_response(
-        self,
-        response_args: Optional[dict] = None,
-        request: Optional[Union[Message, dict]] = None,
-        error: Optional[str] = "",
-        **kwargs
+            self,
+            response_args: Optional[dict] = None,
+            request: Optional[Union[Message, dict]] = None,
+            error: Optional[str] = "",
+            **kwargs
     ) -> dict:
         """
         :param response_args: Information to use when constructing the response
@@ -370,7 +386,6 @@ class Endpoint(Node):
         :param error: Possible error encountered while processing the request
         """
         do_placement = True
-        content_type = "text/html"
         _resp = {}
         _response_placement = None
         if response_args is None:
@@ -380,6 +395,7 @@ class Endpoint(Node):

         resp = None
         if error:
+            content_type = "text/html"
             _response = ResponseMessage(error=error)
             for attr in ["error_description", "error_uri", "state"]:
                 if attr in kwargs:
@@ -389,58 +405,50 @@ class Endpoint(Node):
             _response_placement = kwargs.get("response_placement")
             do_placement = False
             _response = ""
-            content_type = kwargs.get("content_type")
-            if content_type is None:
-                if self.response_content_type:
-                    content_type = self.response_content_type
-                elif self.response_format == "json":
-                    content_type = "application/json"
-                elif self.response_format in ["jws", "jwe", "jose"]:
-                    content_type = "application/jose"
-                elif self.response_format == "text":
-                    content_type = "text/plain"
-                else:
-                    content_type = "application/x-www-form-urlencoded"
+            content_type = self._get_content_type(**kwargs)
         else:
+            content_type = ""
             _response = self.response_info(response_args, request, **kwargs)

         if do_placement:
-            content_type = kwargs.get("content_type")
-            if content_type is None:
-                if self.response_placement == "body":
-                    if self.response_format == "json":
+            if not content_type:
+                content_type = self._get_content_type(**kwargs)
+
+            if self.response_placement == "body":
+                if self.response_format == "json":
+                    if not content_type:
                         content_type = "application/json; charset=utf-8"
-                        if isinstance(_response, Message):
-                            resp = _response.to_json()
-                        else:
-                            resp = json.dumps(_response)
-                    elif self.response_format in ["jws", "jwe", "jose"]:
-                        if self.response_content_type:
-                            content_type = self.response_content_type
-                        else:
-                            content_type = "application/jose; charset=utf-8"
-                        resp = _response
+                    if isinstance(_response, Message):
+                        resp = _response.to_json()
                     else:
+                        resp = json.dumps(_response)
+                elif self.response_format in ["jws", "jwe", "jose"]:
+                    if not content_type:
+                        content_type = "application/jose; charset=utf-8"
+                    resp = _response
+                else:
+                    if not content_type:
                         content_type = "application/x-www-form-urlencoded"
-                        resp = _response.to_urlencoded()
-                elif self.response_placement == "url":
+                    resp = _response.to_urlencoded()
+            elif self.response_placement == "url":
+                if not content_type:
                     content_type = "application/x-www-form-urlencoded"
-                    fragment_enc = kwargs.get("fragment_enc")
-                    if not fragment_enc:
-                        _ret_type = kwargs.get("return_type")
-                        if _ret_type:
-                            fragment_enc = fragment_encoding(_ret_type)
-                        else:
-                            fragment_enc = False
-
-                    if fragment_enc:
-                        resp = _response.request(kwargs["return_uri"], True)
+                fragment_enc = kwargs.get("fragment_enc")
+                if not fragment_enc:
+                    _ret_type = kwargs.get("return_type")
+                    if _ret_type:
+                        fragment_enc = fragment_encoding(_ret_type)
                     else:
-                        resp = _response.request(kwargs["return_uri"])
+                        fragment_enc = False
+
+                if fragment_enc:
+                    resp = _response.request(kwargs["return_uri"], True)
                 else:
-                    raise ValueError(
-                        "Don't know where that is: '{}".format(self.response_placement)
-                    )
+                    resp = _response.request(kwargs["return_uri"])
+            else:
+                raise ValueError(
+                    "Don't know where that is: '{}".format(self.response_placement)
+                )

         if content_type:
             try:
diff --git a/src/idpyoidc/server/endpoint_context.py b/src/idpyoidc/server/endpoint_context.py
index 3b46ef3..ac21db6 100755
--- a/src/idpyoidc/server/endpoint_context.py
+++ b/src/idpyoidc/server/endpoint_context.py
@@ -11,6 +11,7 @@ from jinja2 import FileSystemLoader
 from requests import request

 from idpyoidc.context import OidcContext
+from idpyoidc.message import Message
 from idpyoidc.server import authz
 from idpyoidc.server.claims import Claims
 from idpyoidc.server.claims.oauth2 import Claims as OAUTH2_Claims
@@ -173,6 +174,7 @@ class EndpointContext(OidcContext):
         self.token_args_methods = []
         self.userinfo = None
         self.client_authn_method = {}
+        self.client_known_as = {}

         for param in [
             "issuer",
@@ -186,8 +188,6 @@ class EndpointContext(OidcContext):
             except KeyError:
                 pass

-        self.token_handler_args = get_token_handler_args(conf)
-
         # session db
         self._sub_func = {}
         self.do_sub_func()
@@ -240,9 +240,6 @@ class EndpointContext(OidcContext):
             conf = conf.conf
         _supports = self.supports()
         self.keyjar = self.claims.load_conf(conf, supports=_supports, keyjar=keyjar)
-        self.provider_info = self.claims.provider_info(_supports)
-        self.provider_info["issuer"] = self.issuer
-        self.provider_info.update(self._get_endpoint_info())

         # INTERFACES

@@ -250,23 +247,33 @@ class EndpointContext(OidcContext):

         self.setup_authentication()

-        self.session_manager = SessionManager(
-            self.token_handler_args,
-            sub_func=self._sub_func,
-            conf=conf,
-            upstream_get=self.unit_get)
+        # default is to have session management
+        if self.conf.get("session_management", self.conf["conf"].get("session_management", True)):
+            self.token_handler_args = get_token_handler_args(self.conf)
+
+            self.session_manager = SessionManager(
+                self.token_handler_args,
+                sub_func=self._sub_func,
+                conf=conf,
+                upstream_get=self.unit_get)
+        else:
+            self.session_manager = None

         self.do_userinfo()

         # Must be done after userinfo
         self.setup_login_hint_lookup()
-        self.set_remember_token()
+        if self.session_manager:
+            self.set_remember_token()

         self.setup_client_authn_methods()

-        # _id_token_handler = self.session_manager.token_handler.handler.get("id_token")
-        # if _id_token_handler:
-        #     self.provider_info.update(_id_token_handler.provider_info)
+    def get_metadata(self, supports: Optional[dict] = None, schema: Optional[Message] = None):
+        if supports is None:
+            supports = self.supports()
+        _metadata = self.claims.metadata(supports, schema)
+        _metadata.update(self._get_endpoint_info())
+        return _metadata

     def setup_authz(self):
         authz_spec = self.conf.get("authz")

diff --git a/src/idpyoidc/server/session/grant.py b/src/idpyoidc/server/session/grant.py
index d7ee7c3..53d101c 100644
--- a/src/idpyoidc/server/session/grant.py
+++ b/src/idpyoidc/server/session/grant.py
@@ -377,11 +377,10 @@ class Grant(Item):
             )

             logger.debug(f"token_payload: {token_payload}")
-
             item.value = token_handler(
                 session_id=session_id, usage_rules=usage_rules, **token_payload
             )
-
+            logger.debug(f"token: {item.value}")
             if based_on:
                 based_on.used += 1
         else:
diff --git a/src/idpyoidc/server/session/manager.py b/src/idpyoidc/server/session/manager.py
index ddd5a9d..bb38340 100644
--- a/src/idpyoidc/server/session/manager.py
+++ b/src/idpyoidc/server/session/manager.py
@@ -1,10 +1,12 @@
 import hashlib
 import logging
 import os
-import uuid
 from typing import Callable
 from typing import List
 from typing import Optional
+import uuid
+
+from cryptojwt.jwe.fernet import FernetEncrypter

 from idpyoidc.encrypter import default_crypt_config
 from idpyoidc.message.oauth2 import AuthorizationRequest
@@ -20,9 +22,9 @@ from .grant import Grant
 from .grant import SessionToken
 from .info import ClientSessionInfo
 from .info import UserSessionInfo
-from ..token import handler
 from ..token import UnknownToken
 from ..token import WrongTokenClass
+from ..token import handler
 from ..token.handler import TokenHandler

 logger = logging.getLogger(__name__)
@@ -84,6 +86,7 @@ def ephemeral_id(*args, **kwargs):

 class SessionManager(GrantManager):
     parameter = Database.parameter.copy()
+
     # parameter.update({"salt": ""})
     init_args = ["token_handler_args", "upstream_get"]

@@ -437,30 +440,6 @@ class SessionManager(GrantManager):
         """
         self._revoke_tree(self.get_grant(session_id))

-    # def grants(
-    #         self,
-    #         session_id: Optional[str] = "",
-    #         user_id: Optional[str] = "",
-    #         client_id: Optional[str] = "",
-    # ) -> List[Grant]:
-    #     """
-    #     Find all grant connected to a user session
-    #
-    #     :param client_id:
-    #     :param user_id:
-    #     :param session_id: A session identifier
-    #     :return: A list of grants
-    #     """
-    #     if session_id:
-    #         user_id, client_id, _ = self.decrypt_session_id(session_id)
-    #     elif user_id and client_id:
-    #         pass
-    #     else:
-    #         raise AttributeError("Must have session_id or user_id and client_id")
-    #
-    #     _csi = self.get([user_id, client_id])
-    #     return [self.get([user_id, client_id, gid]) for gid in _csi.subordinate]
-
     def get_session_info(
             self,
             session_id: str,
@@ -551,5 +530,15 @@ class SessionManager(GrantManager):
     def unpack_session_key(self, key):
         return self.unpack_branch_key(key)

-# def create_session_manager(upstream_get, token_handler_args, sub_func=None, conf=None):
-#     return SessionManager(token_handler_args, sub_func=sub_func, conf=conf, upstream_get=upstream_get)
+    def get_client_id_from_token(self, token_value: str, handler_key: Optional[str] = ""):
+        if handler_key:
+            _token_info = self.token_handler.handler[handler_key].info(token_value)
+        else:
+            _token_info = self.token_handler.info(token_value)
+
+        sid = _token_info.get("sid")
+        _path = self.decrypt_branch_id(sid)
+        if len(_path) == 3:
+            return _path[1]
+        else:
+            return _path[-1]
diff --git a/src/idpyoidc/server/token/__init__.py b/src/idpyoidc/server/token/__init__.py
index 8c92e56..d7a8a2a 100755
--- a/src/idpyoidc/server/token/__init__.py
+++ b/src/idpyoidc/server/token/__init__.py
@@ -9,7 +9,6 @@ from idpyoidc.server.util import lv_pack
 from idpyoidc.server.util import lv_unpack
 from idpyoidc.time_util import utc_time_sans_frac
 from idpyoidc.util import rndstr
-
 from .exception import UnknownToken
 from .exception import WrongTokenClass

@@ -92,7 +91,7 @@ class DefaultToken(Token):
         self.token_type = token_type

     def __call__(
-        self, session_id: Optional[str] = "", token_class: Optional[str] = "", **payload
+            self, session_id: Optional[str] = "", token_class: Optional[str] = "", **payload
     ) -> str:
         """
         Return a token.
@@ -105,23 +104,40 @@ class DefaultToken(Token):
         else:
             token_class = "authorization_code"

+        logger.debug(f"Mint {token_class}")
+        logger.debug(f"crypt.key: {self.crypt.key}")
+        _jwks = self.crypt_config.get('jwks', None)
+        logger.debug(f"crypt.jwks: {_jwks}")
+
         if self.lifetime >= 0:
             exp = str(utc_time_sans_frac() + self.lifetime)
         else:
-            exp = "-1"  # Live for ever
+            exp = "-1"  # Live forever

         tmp = ""
         rnd = ""
         while rnd == tmp:  # Don't use the same random value again
             rnd = rndstr(32)  # Ultimate length multiple of 16

-        return base64.b64encode(
+        _args = {
+            "rnd": rnd,
+            "token_class": token_class,
+            "session_id": session_id,
+            "exp": exp
+        }
+        logger.debug(f"Encrypt arguments: {_args}")
+        _value = base64.urlsafe_b64encode(
             self.crypt.encrypt(lv_pack(rnd, token_class, session_id, exp).encode())
         ).decode("utf-8")

+        logger.debug(f"Token: {_value}")
+        return _value
+
     def split_token(self, token):
+        logger.debug(f"split_token: {token}")
+        logger.debug(f"crypt key: {self.crypt.key}")
         try:
-            plain = self.crypt.decrypt(base64.b64decode(token))
+            plain = self.crypt.decrypt(base64.urlsafe_b64decode(token))
         except Exception as err:
             raise UnknownToken(err)
         # order: rnd, type, sid
diff --git a/src/idpyoidc/server/token/handler.py b/src/idpyoidc/server/token/handler.py
index 8fa9063..6289812 100755
--- a/src/idpyoidc/server/token/handler.py
+++ b/src/idpyoidc/server/token/handler.py
@@ -137,6 +137,8 @@ def default_token(spec):
     else:
         return False

+def key_types(keys):
+    return [k["kid"] for k in keys]

 JWKS_FILE = "private/token_jwks.json"

@@ -192,10 +194,18 @@ def factory(
         ("token", token, "access_token"),
         ("refresh", refresh, "refresh_token"),
     ]:
-        if cnf is not None:
-            if default_token(cnf):
-                if kj:
-                    _add_passwd(kj, cnf, cls)
+        if cnf is not None: # else just default
+            try:
+                _key_types = key_types(cnf["kwargs"]["crypt_conf"]["kwargs"]["keys"]["key_defs"])
+            except KeyError: # will fail on keys if it fails
+                pass
+            else:
+                if "key" in _key_types and "password" in _key_types:
+                    raise ValueError("You have to chose one of key or password")
+                if "password" not in _key_types and "key" not in _key_types:
+                    if kj:
+                        _add_passwd(kj, cnf, cls)
+            logger.debug(f"init_token_handler: {cls}")
             args[attr] = init_token_handler(upstream_get, cnf, token_class_map[cls])

     if id_token is not None:
diff --git a/src/idpyoidc/server/token/jwt_token.py b/src/idpyoidc/server/token/jwt_token.py
index abbfa97..534bb49 100644
--- a/src/idpyoidc/server/token/jwt_token.py
+++ b/src/idpyoidc/server/token/jwt_token.py
@@ -1,3 +1,4 @@
+import logging
 from typing import Callable
 from typing import Optional
 from typing import Union
@@ -7,30 +8,32 @@ from cryptojwt.jws.exception import JWSException
 from cryptojwt.utils import importer

 from idpyoidc.server.exception import ToOld
-
-from ...message import Message
-from ...message.oauth2 import JWTAccessToken
-from ..constant import DEFAULT_TOKEN_LIFETIME
-from . import Token
 from . import is_expired
+from . import Token
 from .exception import UnknownToken
 from .exception import WrongTokenClass
+from ..constant import DEFAULT_TOKEN_LIFETIME
+from ...message import Message
+from ...message.oauth2 import JWTAccessToken
+
+logger = logging.getLogger(__name__)


 class JWTToken(Token):
+
     def __init__(
-        self,
-        token_class,
-        # keyjar: KeyJar = None,
-        issuer: str = None,
-        aud: Optional[list] = None,
-        alg: str = "ES256",
-        lifetime: int = DEFAULT_TOKEN_LIFETIME,
-        upstream_get: Callable = None,
-        token_type: str = "Bearer",
-        profile: Optional[Union[Message, str]] = JWTAccessToken,
-        with_jti: Optional[bool] = False,
-        **kwargs
+            self,
+            token_class,
+            # keyjar: KeyJar = None,
+            issuer: str = None,
+            aud: Optional[list] = None,
+            alg: str = "ES256",
+            lifetime: int = DEFAULT_TOKEN_LIFETIME,
+            upstream_get: Callable = None,
+            token_type: str = "Bearer",
+            profile: Optional[Union[Message, str]] = JWTAccessToken,
+            with_jti: Optional[bool] = False,
+            **kwargs
     ):
         Token.__init__(self, token_class, **kwargs)
         self.token_type = token_type
@@ -59,13 +62,13 @@ class JWTToken(Token):
         return payload

     def __call__(
-        self,
-        session_id: Optional[str] = "",
-        token_class: Optional[str] = "",
-        usage_rules: Optional[dict] = None,
-        profile: Optional[Message] = None,
-        with_jti: Optional[bool] = None,
-        **payload
+            self,
+            session_id: Optional[str] = "",
+            token_class: Optional[str] = "",
+            usage_rules: Optional[dict] = None,
+            profile: Optional[Message] = None,
+            with_jti: Optional[bool] = None,
+            **payload
     ) -> str:
         """
         Return a token.
@@ -89,8 +92,10 @@ class JWTToken(Token):
             lifetime = usage_rules.get("expires_in")
         else:
             lifetime = self.lifetime
+        _keyjar = self.upstream_get("attribute", "keyjar")
+        logger.info(f"Key owners in the keyjar: {_keyjar.owners()}")
         signer = JWT(
-            key_jar=self.upstream_get("attribute", "keyjar"),
+            key_jar=_keyjar,
             iss=self.issuer,
             lifetime=lifetime,
             sign_alg=self.alg,
diff --git a/src/idpyoidc/server/xx_metadata.py b/src/idpyoidc/server/xx_metadata.py
new file mode 100644
index 0000000..a75f852
--- /dev/null
+++ b/src/idpyoidc/server/xx_metadata.py
@@ -0,0 +1,54 @@
+from typing import Callable
+from typing import List
+from typing import Optional
+
+from idpyoidc.message import Message
+
+from idpyoidc.transform import preferred_to_registered
+
+
+class XMetadata():
+    def __int__(self, upstream_get: Callable):
+        self.upstream_get = upstream_get
+
+    def get_endpoint_claims(self, entity):
+        _info = {}
+        for endp in entity.server.endpoint.values():
+            if endp.endpoint_name:
+                _info[endp.endpoint_name] = endp.full_path
+                for arg, claim in [("client_authn_method", "auth_methods"),
+                                   ("auth_signing_alg_values", "auth_signing_alg_values")]:
+                    _val = getattr(endp, arg, None)
+                    if _val:
+                        # trust_mark_status_endpoint_auth_methods_supported
+                        md_param = f"{endp.endpoint_name}_{claim}"
+                        _info[md_param] = _val
+        return _info
+
+    def __call__(self,
+                 entity_type: str,
+                 metadata_schema: Optional[Message] = None,
+                 extra_claims: Optional[List[str]] = None,
+                 **kwargs):
+        _claims = self.upstream_get("context").claims
+        entity = self.upstream_get("unit")
+        if not _claims.use:
+            _claims.use = preferred_to_registered(_claims.prefer, supported=entity.supports())
+
+        metadata = _claims.use
+        # the claims that can appear in the metadata
+        if metadata_schema:
+            attr = list(metadata_schema.c_param.keys())
+        else:
+            attr = []